存储xss 反射xss
I’m sure you’ve heard of XSS (Cross-Site Scripting) if you’ve ever been within earshot of a security engineer. As part of the OWASP Top 10, it tends to pop up a lot in security discussions. Unfortunately, the standard explanation (“code injected into a webpage to make it do stuff”) doesn’t really help red or blue teams execute or protect against it.
如果您曾经在安全工程师的视野范围内，我敢肯定您听说过XSS(跨站点脚本)。 作为OWASP Top 10的一部分，它经常在安全性讨论中弹出很多。 不幸的是，标准的解释(“将代码注入到网页中以使其完成工作”)并不能真正帮助红色或蓝色的团队执行或防御它。
更好的解释 (A Better Explanation)
Basically, XSS can occur when a user is allowed to provide input that will be used by the application in some way to alter a view in the interface, without properly sanitizing the user-supplied input. For instance, when you search for a product in an online store and see the search term appear at the top of the results, or in the page title. You provided the term that the application is now using, so what’s to stop you from providing something malicious?
基本上，当允许用户提供输入时，如果没有适当地清理用户提供的输入，则允许用户提供输入，这些输入将由应用程序以某种方式使用以更改界面中的视图。 例如，当您在在线商店中搜索产品并看到搜索词出现在结果的顶部或页面标题中。 您提供了应用程序现在正在使用的术语，那么阻止您提供恶意软件的原因是什么？
This is the premise of XSS.
这是XSS的前提。
榜样学习 (Learning By Example)
We’re going to use a fake web application, UberImage, to illustrate how XSS can occur in the real world. UberImage is a place to upload, tag, and share images with other users. Users can ‘like’ images, and popular images (by likes and views) appear on the front page. I’m sure nothing bad can come from that.
我们将使用一个伪造的Web应用程序UberImage来说明XSS如何在现实世界中发生。 UberImage是一个与其他用户上传，标记和共享图像的地方。 用户可以“点赞”图像，流行的图像(按点赞和查看)显示在首页上。 我敢肯定，没有什么不好的。
Surprise, there are multiple XSS vulnerabilities in our imaginary web app. We’ll be looking at both reflected and persistent XSS attacks. The difference is pretty simple. A reflected XSS attack commonly uses a malicious link to trick a user into accidentally supplying the XSS script (typically in the URL params) and executing it in their browser, while a stored/persistent attack uses the application itself to store the XSS script.
令人惊讶的是，我们虚构的Web应用程序中存在多个XSS漏洞。 我们将研究反射性XSS和持久性XSS攻击。 区别很简单。 反映的XSS攻击通常使用恶意链接诱使用户意外提供XSS脚本(通常在URL参数中)并在其浏览器中执行它，而存储/持久攻击则使用应用程序本身来存储XSS脚本。
So, let’s look at a reflected XSS opportunity first. Check out this page in UberImage:
因此，让我们首先看一下反映的XSS机会。 在UberImage中查看此页面：
At the top of the search results page, there is a search term, “cats”, which is also present in the URL here: search/?q=cats. So what happens if we simply change “cats” to “dogs” in the URL?
在搜索结果页面的顶部，有一个搜索词“ cats”，它也出现在URL中： search /？q = cats 。 那么，如果我们仅将URL中的“ cats”更改为“ dogs”，会发生什么？
Interesting. Let’s see what the html looks like for this part of the page:
有趣。 让我们看一下该页面的html外观：
So, it looks like the search term is plugged into the search bar at the top of the page through the ‘value’ attribute of the input tag. How can we use this to our advantage? Check out this URL:
因此，搜索字词似乎通过输入标签的“值”属性插入了页面顶部的搜索栏中。 我们如何利用这一优势？ 查看以下URL：
http://uberimage.io/search/?q=cats”/>alert(1)
http://uberimage.io/search/?q=cats” /> 警报(1)
Sending this URL results in the following result on the page:
发送此URL将在页面上显示以下结果：
Congrats, we’ve just found the reflected XSS injection point. How can we possibly exploit this to do something more than just annoy the victim with an alert? Let’s imagine that this amazing application has an API call to change a user’s password (reasonable, right?). Most websites use token authentication these days, stored as cookies in the browser. We could use this XSS vuln to grab that cookie, and use it to authenticate to the API and change a user’s password without them having any knowledge of the event:
恭喜，我们刚刚找到了反射的XSS注入点。 除了利用警报使受害者烦恼之外，我们还可以如何利用它做更多的事情？ 让我们想象一下，这个惊人的应用程序具有一个API调用来更改用户的密码(合理吗？)。 如今，大多数网站都使用令牌身份验证，并以cookie的形式存储在浏览器中。 我们可以使用此XSS vuln来获取该cookie，并使用它来向API进行身份验证并更改用户的密码，而无需他们了解事件：
http://uberimage.io/search/?q=cats%22%3Cscript%3Efetch%28%27http%3A%2F%2Fuberimage.io%2Fapi%2Fpassword%2Fchange%27%2C%20%7Bmethod%3A%20%27post%27%2C%20body%3A%20JSON.stringify%28%7Btoken%3A%20document.cookie.match%28%27%28%5E%7C%3B%29%5C%5Cs%2A%27%20%2B%20%22auth_token%22%20%2B%20%27%5C%5Cs%2A%3D%5C%5Cs%2A%28%5B%5E%3B%5D%2B%29%27%29%2C%20new_passwd%3A%20%22mynewpass123%22%7D%29%7D%29.then%28res%3D%3Eres.json%28%29%29%3C%2Fscript%3E
http://uberimage.io/search/?q=cats%22%3Cscript%3Efetch%28%27http%3A%2F%2Fuberimage.io%2Fapi%2Fpassword%2Fchange%27%2C%20%7Bmethod%3A%20 ％27post％27％2C％20body％3A％20JSON.stringify％28％7Btoken％3A％20document.cookie.match％28％27％28％5E％7C％3B％29％5C％5Cs％2A％27％20 ％2B％20％22auth_token％22％20％2B％20％27％5C％5Cs％2A％3D％5C％5Cs％2A％28％5B％5E％3B％5D％2B％29％27％29％2C ％20new_passwd％3A％20％22mynewpass123％22％7D％29％7D％29.then％28res％3D％3Eres.json％28％29％29％3 %% C％2Fscript％3E
Looks pretty crazy, but not unlike a lot of links out there with a lot of params. In this example, we’ve URL encoded the XSS script to make it easier to share and less obvious what it is doing. Here’s what it looks like decoded and formatted as a script:
看起来很疯狂，但与存在许多参数的许多链接一样。 在此示例中，我们对XSS脚本进行了URL编码，以使其更易于共享并且不明显其操作。 看起来像是脚本解码和格式化的样子：
Now, it’s much more obvious what we’re doing. We’re using a call to fetch() to post the token (grabbed with a call to document.cookie()) and change the password to something we know, “mynewpass123”. So now, all we have to do is share this link with somebody to hack into their account.
现在，我们正在做的事情更加明显。 我们正在使用对fetch()的调用来发布令牌(带有对document.cookie()的调用)并将密码更改为我们知道的“ mynewpass123”。 因此，现在，我们要做的就是与某人共享此链接以入侵他们的帐户。
It can’t possibly be this easy in the real world, right? Yes and no. Many of these simple exploits have been phased out by all major web frameworks, and modern browsers don’t even allow javascript to be sent as URL params for security reasons (you can see why). However, the cards can fall in the right places if:
在现实世界中不可能这么容易，对吧？ 是的，没有。 所有主要的Web框架都已淘汰了许多这些简单的漏洞利用，并且出于安全原因，现代浏览器甚至不允许将JavaScript作为URL参数发送(您可以看到原因)。 但是，如果出现以下情况，这些卡可能会落在正确的位置：
- The vulnerability exists in the application (a developer has used a roll-your-own security approach) 该漏洞存在于应用程序中(开发人员使用了自己的安全措施)
- The target is using an outdated browser 目标使用的是过时的浏览器
- The target clicks links without inspecting them (really not a stretch)目标点击链接而不检查链接(实际上不是很费力)
Ok, so how do we do something a little less dependent on so many factors coming together just right? Enter persistent XSS. For this type of vulnerability, we’re going to look at the upload form for UberImage:
好了，我们该怎么做一些不那么依赖于很多因素走到一起恰到好处？ 输入永久XSS。 对于这种类型的漏洞，我们将查看UberImage的上传表单：
Looks pretty normal. Checking out the ‘tags’ field, it looks like we can enter any word and use it as a tag. Neato. Let’s test the limits of this input and try to enter the age-old XSS test, :
看起来很正常。 查看“标签”字段，看来我们可以输入任何单词并将其用作标签。 Neato。 让我们测试此输入的限制，并尝试输入古老的XSS测试